kotovalexarian-likes-github/rails--rails
1
0
Fork 0
mirror of https://github.com/rails/rails.git synced 2022-11-09 12:12:34 -05:00
Code Releases Activity

FileHandler should not be called for files outside the root

Browse source 
FileHandler#matches? should return false for files that are outside the
"root" path.
This commit is contained in:
Aaron Patterson 2014-10-10 16:00:03 -07:00
parent 5127857947
commit d1123f2056
2 changed files with 32 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
actionpack/lib/action_dispatch/middleware/static.rb
View file

@ -24,9 +24,19 @@ module ActionDispatch
path = URI.parser.unescape(path)
return false unless path.valid_encoding?
paths = [path, "#{path}#{ext}", "#{path}/index#{ext}"]
paths = [path, "#{path}#{ext}", "#{path}/index#{ext}"].map { |v|
Rack::Utils.clean_path_info v
}
if match = paths.detect {|p| File.file?(File.join(@root, p)) }
if match = paths.detect { |p|
path = File.join(@root, p)
begin
File.file?(path) && File.readable?(path)
rescue SystemCallError
false
end
}
return ::Rack::Utils.escape(match)
end
end

22
actionpack/test/dispatch/static_test.rb
View file

@ -200,7 +200,8 @@ class StaticTest < ActiveSupport::TestCase
}
def setup
@app = ActionDispatch::Static.new(DummyApp, "#{FIXTURE_LOAD_PATH}/public", "public, max-age=60")
@root = "#{FIXTURE_LOAD_PATH}/public"
@app = ActionDispatch::Static.new(DummyApp, @root, "public, max-age=60")
end
def public_path
@ -208,11 +209,28 @@ class StaticTest < ActiveSupport::TestCase
end
include StaticTests
def test_custom_handler_called_when_file_is_outside_root
filename = 'shared.html.erb'
assert File.exist?(File.join(@root, '..', filename))
env = {
"REQUEST_METHOD"=>"GET",
"REQUEST_PATH"=>"/..%2F#{filename}",
"PATH_INFO"=>"/..%2F#{filename}",
"REQUEST_URI"=>"/..%2F#{filename}",
"HTTP_VERSION"=>"HTTP/1.1",
"SERVER_NAME"=>"localhost",
"SERVER_PORT"=>"8080",
"QUERY_STRING"=>""
}
assert_equal(DummyApp.call(nil), @app.call(env))
end
end
class StaticEncodingTest < StaticTest
def setup
@app = ActionDispatch::Static.new(DummyApp, "#{FIXTURE_LOAD_PATH}/公共", "public, max-age=60")
@root = "#{FIXTURE_LOAD_PATH}/公共"
@app = ActionDispatch::Static.new(DummyApp, @root, "public, max-age=60")
end
def public_path